I'm trying to decrypt all of my ssh logs (in order to give them reasonable tags with logstash). But I have found one case that I dont really understand:
Oct 23 07:43:47 sshd[59830]: Connection from 74.194.6.5 port 60126 on 213.67.100.148 port 22
Oct 23 07:43:51 sshd[59830]: error: maximum authentication attempts exceeded for root from 74.194.6.5 port 60126 ssh2 [preauth]
Oct 23 07:43:51 sshd[59830]: Disconnecting authenticating user root 74.194.6.5 port 60126: Too many authentication failures [preauth]
How can it reach the maximum authentication attempts without giving any sign of a authentication attempt?
Usually I get things like before the "maximum auth..." row appears.
Oct 23 08:54:06 sshd[62392]: Failed keyboard-interactive/pam for [...]
Oct 23 08:52:41 sshd[49690]: Failed publickey for [...]
But not always.
Please note, I dont have problems logging in..